Hardware Enforced Security Governing Access to an Operating System

1. A device, comprising: a processor; a low privilege environment hosting a login agent module and an operating system login authentication module, the login agent module to cause a prompt to be presented by a user interface in the device, the prompt requesting login information to be entered into the device; a trusted execution environment hosting a secure user authentication module, the secure user authentication module to transmit an encrypted authorization message based on receipt of a signed login success message; a secure policy login module to at least determine a context for the device and to set a login policy for at least one of the login agent or the operating system login authentication module based on the context; and an authentication recovery module to reconfigure user-related security in the device by communicating with a remote resource; wherein the operating system login authentication module is to receive the login information from the login agent module and to transmit the signed login success message to the secure user authentication module based on the login information.

2. The device of claim 1 , wherein the secure user authentication module is further to transmit the encrypted authentication message to the operating system login authentication module based on authenticating the signed login success message.

3. The device of claim 2 , wherein the operating system login authentication module is further to grant access to the device based on receipt and authentication of the encrypted authentication message.

4. The device of claim 2 , wherein the trusted execution environment is further to load the secure user authentication module.

5. The device of claim 3 , further comprising a firmware interface module to convey the signed login success message from the operating system login authentication module to the secure login authentication module and the encrypted authentication message from the secure login authentication module to the operating system login authentication module.

6. The device of claim 1 , wherein the operating system login authentication module is further to authenticate the login information against known user information from within said trusted execution environment.

7. The device of claim 6 , wherein the operating system login authentication module is further to use the known user information to secure a private key, the private key being accessible when the login information is authenticated against the known user information.

8. The device of claim 7 , wherein the operating system login authentication module is further to generate the signed login success message using the private key.

9. The device of claim 7 , wherein the private key is encrypted by said trusted execution environment.

10. The device of claim 1 , wherein the secure user authentication module is further to cause the device to shut down if a signed login success message is not received, and the secure policy login module is further to set an amount of time for the secure user authentication module to wait for receipt of the signed login success message before causing the device to shut down.